Security Architecture
Last updated: August 2026
1. Architecture & Multi-Tenant Isolation
Row-Level Data Scoping: All customer records, contact timelines, call audio logs, and message payloads are isolated per-tenant at the database layer using scoped query middleware and cryptographic workspace identifiers.
Containerized Microservices: Telephony media routing (FreeSWITCH / RTPengine), SIP proxying (Kamailio), real-time WebSockets, and background workers operate in containerized, compartmentalized infrastructure.
2. Encryption In-Transit & At-Rest
In-Transit: All external web traffic and REST/WebSocket APIs are protected using TLS 1.3 encryption. WebRTC voice streams utilize SRTP/DTLS end-to-end media encryption.
At-Rest: Database volumes, customer call recordings, and cloud file storage are encrypted at rest using industry-standard AES-256 encryption.
3. Authentication & Access Controls
Role-Based Access Control (RBAC): Strict permission enforcement separates Platform Owner, Tenant Admin, Supervisor, Agent, and Finance roles across every API controller.
Two-Factor Authentication (2FA): Support for RFC 6238 TOTP authenticators with encrypted backup recovery codes.
Single Sign-On (SSO): Enterprise SAML 2.0 and OAuth identity federation (Google Workspace, Microsoft Azure AD).
Audit Logging: Immutable audit trails record security events, user role changes, impersonation actions, and data export events.
4. Vulnerability Management & Incident Response
We run automated dependency vulnerability scanning and continuous integration testing on all software releases.
To report a security vulnerability or responsible disclosure, please contact security@skyfalkeconnect.io.